CVE-2026-12240 - Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field
CVE ID :CVE-2026-12240 Published : June 30, 2026, 6:52 a.m. | 2 hours, 19 minutes ago Description :The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including,...